Discord accounts are stolen at industrial scale, and usually not by guessing passwords. The platform's signature scams - Fake free-Nitro links, poisoned game "betas" sent by already-compromised friends, malicious QR-code logins - Deliver malware that grabs your authentication token or credentials outright. When any of that happens, or when you get a login-from-new-location email you don't recognize, changing your password is the reset button: it rotates the credential and invalidates the stolen token. It's also simply overdue if your Discord password is short, old, or shared with other sites.
Change Your Discord Password on Desktop or Web
The desktop app and the browser version share the same interface:
- Open Discord and click the gear icon (User Settings) next to your username near the bottom-left.
- Select My Account.
- Click the Change Password button.
- Enter your current password, then the new one (twice, if prompted).
- Confirm. If you have 2FA enabled, you'll enter a code as well.
Have the replacement ready before you click: a random 16+ character string from a password generator that exists nowhere else in your life. Discord accounts are traded in bulk on shady markets precisely because people protect them with recycled passwords - The harvesting side of that economy is described in our infostealer malware guide.
Change It in the Mobile App
- Open Discord and tap your avatar (bottom-right) to open your profile.
- Tap the settings gear, then open Account.
- Tap Password (or the change-password option under the security heading).
- Verify with your current password, enter the new one, and save.
Menu labels shift slightly between app versions, but the route is always profile → settings → account → password. If your account was created on mobile with only a phone number, you may be asked to add an email first - Do it, because email is your recovery lifeline.
If You've Forgotten Your Password
- On the Discord login screen, enter your email and click Forgot your password?.
- Discord emails a reset link to the address on the account.
- Follow it and set the new password. A 2FA code is still required if you have it enabled.
Two gotchas. First, if you registered by phone number, the reset can go via SMS instead - But email-based recovery is more dependable, so attach one. Second, if an attacker changed your email already, use the "email change" revert link Discord sends to the old address when the change happens; it's time-limited, so act on it fast. Beyond that, Discord support can help through their official request form - Never through anyone who DMs you offering help, which is the follow-up scam.
After You Change It
- Know that other sessions die with the token. A password change invalidates your old token, logging out other devices - The malware that stole it is now holding a dead credential. If malware was the cause, though, clean the machine first or the new token gets stolen too.
- Enable two-factor authentication. In My Account, turn on authenticator-app 2FA - See how time-based codes work with our TOTP generator - And download your backup codes immediately. Discord is notoriously strict about 2FA lockouts; those codes are your safety net, as our backup codes guide explains.
- Review authorized apps. In settings under authorized apps, revoke anything you don't recognize - OAuth grants survive password changes.
- Update your password manager, and while you're in the vault, rotate this password anywhere else it appeared.
- Check your username and connections for tampering if the account was compromised. If you're rebuilding an alt or a server-bot identity, the username generator can produce something clean.
On Discord, assume every "free Nitro" link is a credential trap until proven otherwise. No password survives being typed into a scammer's clone site.
The paths compared:
| Route | Path | Requires | Effect on other sessions |
|---|---|---|---|
| Desktop/web change | Gear icon → My Account → Change Password | Current password (+ 2FA code) | Logged out (token invalidated) |
| Mobile change | Avatar → Settings → Account → Password | Current password (+ 2FA code) | Logged out (token invalidated) |
| Forgot-password reset | Login → Forgot your password → email link | Access to account email | Logged out after reset |
Since gaming and community accounts tend to share passwords in the same friend groups, the same cleanup applies to your music login too - Here's the equivalent walkthrough for changing your Spotify password.
FAQ
Does changing my Discord password log out other devices?
Yes. Changing the password invalidates your account token, which forces every session - Including any attacker holding a stolen token - To re-authenticate. That's why a password change is the standard first response to Discord token theft, right after removing the malware that grabbed it.
My account got "hacked" but my password still works. How?
Discord malware usually steals your session token rather than your password, letting the attacker act as you without ever logging in. Changing your password kills the token. If you just remove the malware without changing the password, the stolen token keeps working until it expires or is invalidated.
Can I change my Discord password without knowing the current one?
Not from inside settings - The change form requires it. Log out (or open a private browser window) and use the forgot-password flow instead; the emailed reset link lets you set a new password with only access to your inbox plus any 2FA factor.
Is SMS 2FA good enough for Discord?
An authenticator app is meaningfully better: SMS can be intercepted through SIM-swapping, and Discord's SMS backup can act as a fallback that weakens app-based protection if your number is hijacked. Use an authenticator app, store the backup codes somewhere safe, and keep your email account equally locked down.